better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision
@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).
CVE-2026-67330
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-67330
scim
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
scim
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "better-auth",
"product": "scim",
"versions": [
{
"status": "affected",
"version": "1.4.0-beta.27",
"lessThan": "*",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/%40better-auth/scim",
"defaultStatus": "unaffected"
},
{
"vendor": "better-auth",
"product": "scim",
"versions": [
{
"status": "affected",
"version": "1.7.0-beta.0",
"lessThan": "*",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/%40better-auth/scim",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-67330
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #12808 · Revision 1
- Added to Heist Feed
- Publisher date